On Estimating Cyber Adversaries’ Capabilities: A Bayesian Model Approach

Introduction

Cyber adversaries refer to people or groups who do harm to the information system, such as hackers, espionage persons, and terrorists. Different Cyber adversaries have different motivations, and obviously, have different resources and attack techniques. The resource and attack techniques are referred to as adversaries’ capacities. Accurate estimation of adversaries’ capacities can help network administrator to use different approaches to prevent potential attacks or respond to emerging attacks. However, cyber adversaries’ capabilities are hidden, dynamic and difficult to observe directly. This poster aims to take a systemic approach to estimate adversaries’ capacities. Since we cannot obtain complete information about the adversaries, a reasonable approach is to estimate adversaries’ capabilities using partial information that has been observed. The estimation hypothesis, initially stating that the adversary has equal probabilities to have high level capacities and low level capacities, will be refined using Bayesian rules as we collect more evidences from network data.

This work is supported in part by the National High-Tech Research and Development Plan of China under Grant No.2007AA010601 and the Knowledge Innovation Key Directional Program of Chinese Academy of Sciences under Grant No. KGCX2-YW-125. The authors would like to thank Dr. Peng Ning at North Carolina State University for his insightful discussion.